dbf4b195787763a40ea50f14e88a4f6d75ddb3d595359b7f051916f7a369bc9c

Sharing

Copy URL Twitter E-mail

General

Target
dbf4b195787763a40ea50f14e88a4f6d75ddb3d595359b7f051916f7a369bc9c
Size 270KB
Sample240707-nr5dms1dkq
SHA256 dbf4b195787763a40ea50f14e88a4f6d75ddb3d595359b7f051916f7a369bc9c
MD5 c780b0902a3a27e704d3b34fe18027f6
SHA1 464cc3b9d8c8dc5e698fad83188cf34755965e35
SHA512 7121e9f1eba38d2644325cca02ac7122a3796b32703ca8d4efe8ae85fe4fd38461cba6b4dca86fe8e8501de7707b939848500888a383402cea88edd182672b28
SSDEEP 3072:YrmgYQPXIOmkIhNpgWSDH/ahc9Hr3y8qxCo9D6jOcKZQpux0BiQWVrLsMWsy4iIc:0mg5mLpdSbni8qIUujkQ4x0B/WOMWW
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dbf4b195787763a40ea50f14e88a4f6d75ddb3d595359b7f051916f7a369bc9c

File Explorer

dbf4b195787763a40ea50f14e88a4f6d75ddb3d595359b7f051916f7a369bc9c

.exe 270KB

dbf4b195787763a40ea50f14e88a4f6d75ddb3d595359b7f051916f7a369bc9c

IMPHASH c7222a0d5b42e4f55fd655beb4564ce5
SHA256 dbf4b195787763a40ea50f14e88a4f6d75ddb3d595359b7f051916f7a369bc9c
MD5 c780b0902a3a27e704d3b34fe18027f6
SHA1 464cc3b9d8c8dc5e698fad83188cf34755965e35
SHA512 7121e9f1eba38d2644325cca02ac7122a3796b32703ca8d4efe8ae85fe4fd38461cba6b4dca86fe8e8501de7707b939848500888a383402cea88edd182672b28
SSDEEP 3072:YrmgYQPXIOmkIhNpgWSDH/ahc9Hr3y8qxCo9D6jOcKZQpux0BiQWVrLsMWsy4iIc:0mg5mLpdSbni8qIUujkQ4x0B/WOMWW
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8459

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

IsBadStringPtrW GetConsoleAliasesLengthW SetEndOfFile FindResourceW CreateDirectoryW WriteConsoleInputA GetModuleHandleW VirtualFree LoadLibraryW ReplaceFileW GetModuleFileNameW GlobalUnlock GetLastError SetLastError GetProcAddress AttachConsole FindResourceA OpenMutexA LocalAlloc GlobalGetAtomNameW EnumResourceTypesW GetOEMCP CancelIo OpenFileMappingW GetWindowsDirectoryW HeapReAlloc HeapSize GetStringTypeW MultiByteToWideChar CreateFileA RemoveVectoredExceptionHandler GetDateFormatW LCMapStringW RtlUnwind Sleep GetCommandLineA HeapSetInformation GetStartupInfoW IsProcessorFeaturePresent HeapAlloc HeapFree SetUnhandledExceptionFilter ExitProcess DecodePointer WriteFile GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime UnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess GetCPInfo GetACP IsValidCodePage LeaveCriticalSection EnterCriticalSection RaiseException

user32

InsertMenuItemW GetKeyboardLayoutNameW GetCaretPos SetMessageExtraInfo CharUpperBuffW DdeKeepStringHandle GetClassInfoW

gdi32

GetCharWidthW

advapi32

GetLengthSid

shell32

FindExecutableA

ole32

CoRevokeClassObject CoMarshalHresult

winhttp

WinHttpWriteData

Sharing

General

Malware Config

Signatures

File Explorer

dbf4b195787763a40ea50f14e88a4f6d75ddb3d595359b7f051916f7a369bc9c

kernel32

user32

gdi32

advapi32

shell32

ole32

winhttp

generic